* [PATCH v7 0/2] crypto: AF_ALG: add AEAD and RNG support @ 2015-01-02 14:40 ` Stephan Mueller 0 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-02 14:40 UTC (permalink / raw) To: 'Herbert Xu' Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-crypto-u79uwXL29TY76Z2rM5mHXA, ABI/API Hi, This patch set adds AEAD and RNG support to the AF_ALG interface exported by the kernel crypto API. By extending AF_ALG with AEAD and RNG support, all cipher types the kernel crypto API allows access to are now accessible from userspace. Both, AEAD and RNG implementations are stand-alone and do not depend other AF_ALG interfaces (like hash or skcipher). The AEAD implementation uses the same approach as provided with skcipher by offering the following interfaces: * sendmsg and recvmsg interfaces allowing multiple invocations supporting a threaded user space. To support multi-threaded user space, kernel-side buffering is implemented similarly to skcipher. * splice / vmsplice interfaces allowing a zero-copy invocation The RNG interface only implements the recvmsg interface as zero-copy is not applicable. The new AEAD and RNG interfaces are fully tested with the test application provided at [1]. That test application exercises all newly added user space interfaces. The testing covers: * use of the sendmsg/recvmsg interface * use of the splice / vmsplice interface * invocation of all AF_ALG types (aead, rng, skcipher, hash) * using all types of operation (encryption, decryption, keyed MD, MD, random numbers, AEAD decryption with positive and negative authentication verification) * stress testing by running all tests for 30 minutes in an endless loop * test execution on 64 bit and 32 bit [1] http://www.chronox.de/libkcapi.html Changes v2: * rebase to current cryptodev-2.6 tree * use memzero_explicit to zeroize AEAD associated data * use sizeof for determining length of AEAD associated data * update algif_rng.c covering all suggestions from Daniel Borkmann <dborkman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> * addition of patch 9: add digestsize interface for hashes * addition of patch to update documentation covering the userspace interface * change numbers of getsockopt options: separate them from sendmsg interface definitions Changes v3: * remove getsockopt interface * AEAD: associated data is set prepended to the plain/ciphertext * AEAD: allowing arbitrary associated data lengths * remove setkey patch as protection was already in the existing code Changes v4: * stand-alone implementation of AEAD * testing of all interfaces offered by AEAD * stress testing of AEAD and RNG Changes v5: * AEAD: add outer while(size) loop in aead_sendmsg to ensure all data is copied into the kernel (reporter Herbert Xu) * AEAD: aead_sendmsg bug fix: change size -= len; to size -= plen; * AF_ALG / AEAD: add aead_setauthsize and associated extension to struct af_alg_type as well as alg_setsockopt (reporter Herbert Xu) * RNG: rng_recvmsg: use 128 byte stack variable for output of RNG instead of ctx->result (reporter Herbert Xu) * RNG / AF_ALG: allow user space to seed RNG via setsockopt * RNG: rng_recvmsg bug fix: use genlen as result variable for crypto_rng_get_bytes as previously no negative errors were obtained * AF_ALG: alg_setop: zeroize buffer before free Changes v6: * AEAD/RNG: port to 3.19-rc1 with the iov_iter handling * RNG: use the setkey interface to obtain the seed and drop the patch adding a separate reseeding interface * extract the zeroization patch for alg_setkey into a stand-alone patch submission * fix bug in aead_sufficient_data (reporter Herbert Xu) * testing of all interfaces with test application provided with libkcapi version 0.6.2 Changes v7: * AEAD: aead_recvmsg: change error code from ENOMEM to EINVAL * AEAD: drop aead_readable/aead_sufficient_data and only use ctx->more to decide whether the read side shall become active. This change requires that the patch for crypto_aead_decrypt ensuring that the ciphertext contains the authentication tag was added -- see https://lkml.org/lkml/2014/12/30/200. Otherwise, user space can trigger a kernel crash. * RNG: patch dropped as it was applied * AEAD: port Kconfig/Makefile patch forward to current code base Stephan Mueller (2): crypto: AF_ALG: add AEAD support crypto: AF_ALG: enable AEAD interface compilation crypto/Kconfig | 9 + crypto/Makefile | 1 + crypto/algif_aead.c | 631 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 641 insertions(+) create mode 100644 crypto/algif_aead.c -- 2.1.0 ^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v7 0/2] crypto: AF_ALG: add AEAD and RNG support @ 2015-01-02 14:40 ` Stephan Mueller 0 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-02 14:40 UTC (permalink / raw) To: 'Herbert Xu' Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API Hi, This patch set adds AEAD and RNG support to the AF_ALG interface exported by the kernel crypto API. By extending AF_ALG with AEAD and RNG support, all cipher types the kernel crypto API allows access to are now accessible from userspace. Both, AEAD and RNG implementations are stand-alone and do not depend other AF_ALG interfaces (like hash or skcipher). The AEAD implementation uses the same approach as provided with skcipher by offering the following interfaces: * sendmsg and recvmsg interfaces allowing multiple invocations supporting a threaded user space. To support multi-threaded user space, kernel-side buffering is implemented similarly to skcipher. * splice / vmsplice interfaces allowing a zero-copy invocation The RNG interface only implements the recvmsg interface as zero-copy is not applicable. The new AEAD and RNG interfaces are fully tested with the test application provided at [1]. That test application exercises all newly added user space interfaces. The testing covers: * use of the sendmsg/recvmsg interface * use of the splice / vmsplice interface * invocation of all AF_ALG types (aead, rng, skcipher, hash) * using all types of operation (encryption, decryption, keyed MD, MD, random numbers, AEAD decryption with positive and negative authentication verification) * stress testing by running all tests for 30 minutes in an endless loop * test execution on 64 bit and 32 bit [1] http://www.chronox.de/libkcapi.html Changes v2: * rebase to current cryptodev-2.6 tree * use memzero_explicit to zeroize AEAD associated data * use sizeof for determining length of AEAD associated data * update algif_rng.c covering all suggestions from Daniel Borkmann <dborkman@redhat.com> * addition of patch 9: add digestsize interface for hashes * addition of patch to update documentation covering the userspace interface * change numbers of getsockopt options: separate them from sendmsg interface definitions Changes v3: * remove getsockopt interface * AEAD: associated data is set prepended to the plain/ciphertext * AEAD: allowing arbitrary associated data lengths * remove setkey patch as protection was already in the existing code Changes v4: * stand-alone implementation of AEAD * testing of all interfaces offered by AEAD * stress testing of AEAD and RNG Changes v5: * AEAD: add outer while(size) loop in aead_sendmsg to ensure all data is copied into the kernel (reporter Herbert Xu) * AEAD: aead_sendmsg bug fix: change size -= len; to size -= plen; * AF_ALG / AEAD: add aead_setauthsize and associated extension to struct af_alg_type as well as alg_setsockopt (reporter Herbert Xu) * RNG: rng_recvmsg: use 128 byte stack variable for output of RNG instead of ctx->result (reporter Herbert Xu) * RNG / AF_ALG: allow user space to seed RNG via setsockopt * RNG: rng_recvmsg bug fix: use genlen as result variable for crypto_rng_get_bytes as previously no negative errors were obtained * AF_ALG: alg_setop: zeroize buffer before free Changes v6: * AEAD/RNG: port to 3.19-rc1 with the iov_iter handling * RNG: use the setkey interface to obtain the seed and drop the patch adding a separate reseeding interface * extract the zeroization patch for alg_setkey into a stand-alone patch submission * fix bug in aead_sufficient_data (reporter Herbert Xu) * testing of all interfaces with test application provided with libkcapi version 0.6.2 Changes v7: * AEAD: aead_recvmsg: change error code from ENOMEM to EINVAL * AEAD: drop aead_readable/aead_sufficient_data and only use ctx->more to decide whether the read side shall become active. This change requires that the patch for crypto_aead_decrypt ensuring that the ciphertext contains the authentication tag was added -- see https://lkml.org/lkml/2014/12/30/200. Otherwise, user space can trigger a kernel crash. * RNG: patch dropped as it was applied * AEAD: port Kconfig/Makefile patch forward to current code base Stephan Mueller (2): crypto: AF_ALG: add AEAD support crypto: AF_ALG: enable AEAD interface compilation crypto/Kconfig | 9 + crypto/Makefile | 1 + crypto/algif_aead.c | 631 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 641 insertions(+) create mode 100644 crypto/algif_aead.c -- 2.1.0 ^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v7 1/2] crypto: AF_ALG: add AEAD support 2015-01-02 14:40 ` Stephan Mueller (?) @ 2015-01-02 14:41 ` Stephan Mueller [not found] ` <1609020.xcc11L81HZ-PJstQz4BMNNP20K/wil9xYQuADTiUCJX@public.gmane.org> -1 siblings, 1 reply; 13+ messages in thread From: Stephan Mueller @ 2015-01-02 14:41 UTC (permalink / raw) To: 'Herbert Xu' Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API This patch adds the AEAD support for AF_ALG. The implementation is based on algif_skcipher, but contains heavy modifications to streamline the interface for AEAD uses. To use AEAD, the user space consumer has to use the salg_type named "aead". The AEAD implementation includes some overhead to calculate the size of the ciphertext, because the AEAD implementation of the kernel crypto API makes implied assumption on the location of the authentication tag. When performing an encryption, the tag will be added to the created ciphertext (note, the tag is placed adjacent to the ciphertext). For decryption, the caller must hand in the ciphertext with the tag appended to the ciphertext. Therefore, the selection of the used memory needs to add/subtract the tag size from the source/destination buffers depending on the encryption type. The code is provided with comments explaining when and how that operation is performed. A fully working example using all aspects of AEAD is provided at http://www.chronox.de/libkcapi.html Signed-off-by: Stephan Mueller <smueller@chronox.de> --- crypto/algif_aead.c | 631 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 631 insertions(+) create mode 100644 crypto/algif_aead.c diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c new file mode 100644 index 0000000..c461266 --- /dev/null +++ b/crypto/algif_aead.c @@ -0,0 +1,631 @@ +/* + * algif_aeadr: User-space interface for AEAD algorithms + * + * Copyright (C) 2014, Stephan Mueller <smueller@chronox.de> + * + * This file provides the user-space API for AEAD ciphers. + * + * This file is derived from algif_skcipher.c. + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the Free + * Software Foundation; either version 2 of the License, or (at your option) + * any later version. + * + */ + +#include <crypto/scatterwalk.h> +#include <crypto/if_alg.h> +#include <linux/init.h> +#include <linux/list.h> +#include <linux/kernel.h> +#include <linux/mm.h> +#include <linux/module.h> +#include <linux/net.h> +#include <net/sock.h> + +struct aead_sg_list { + unsigned int cur; + struct scatterlist sg[ALG_MAX_PAGES]; +}; + +struct aead_ctx { + struct aead_sg_list tsgl; + struct af_alg_sgl rsgl; + + void *iv; + + struct af_alg_completion completion; + + unsigned long used; + + unsigned int len; + bool more; + bool merge; + bool enc; + + size_t aead_assoclen; + struct aead_request aead_req; +}; + +static inline int aead_sndbuf(struct sock *sk) +{ + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + + return max_t(int, max_t(int, sk->sk_sndbuf & PAGE_MASK, PAGE_SIZE) - + ctx->used, 0); +} + +static inline bool aead_writable(struct sock *sk) +{ + return PAGE_SIZE <= aead_sndbuf(sk); +} + +static void aead_put_sgl(struct sock *sk) +{ + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + struct aead_sg_list *sgl = &ctx->tsgl; + struct scatterlist *sg = sgl->sg; + unsigned int i; + + for (i = 0; i < sgl->cur; i++) { + if (!sg_page(sg + i)) + continue; + + put_page(sg_page(sg + i)); + sg_assign_page(sg + i, NULL); + } + sgl->cur = 0; + ctx->used = 0; + ctx->more = 0; + ctx->merge = 0; +} + +static int aead_wait_for_wmem(struct sock *sk, unsigned flags) +{ + long timeout; + DEFINE_WAIT(wait); + int err = -ERESTARTSYS; + + if (flags & MSG_DONTWAIT) + return -EAGAIN; + + set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags); + + for (;;) { + if (signal_pending(current)) + break; + prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); + timeout = MAX_SCHEDULE_TIMEOUT; + if (sk_wait_event(sk, &timeout, aead_writable(sk))) { + err = 0; + break; + } + } + finish_wait(sk_sleep(sk), &wait); + + return err; +} + +static void aead_wmem_wakeup(struct sock *sk) +{ + struct socket_wq *wq; + + if (!aead_writable(sk)) + return; + + rcu_read_lock(); + wq = rcu_dereference(sk->sk_wq); + if (wq_has_sleeper(wq)) + wake_up_interruptible_sync_poll(&wq->wait, POLLIN | + POLLRDNORM | + POLLRDBAND); + sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN); + rcu_read_unlock(); +} + +static int aead_wait_for_data(struct sock *sk, unsigned flags) +{ + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + long timeout; + DEFINE_WAIT(wait); + int err = -ERESTARTSYS; + + if (flags & MSG_DONTWAIT) { + return -EAGAIN; + } + + set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); + + for (;;) { + if (signal_pending(current)) + break; + prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); + timeout = MAX_SCHEDULE_TIMEOUT; + if (sk_wait_event(sk, &timeout, !ctx->more)) { + err = 0; + break; + } + } + finish_wait(sk_sleep(sk), &wait); + + clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); + + return err; +} + +static void aead_data_wakeup(struct sock *sk) +{ + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + struct socket_wq *wq; + + if (ctx->more) + return; + + rcu_read_lock(); + wq = rcu_dereference(sk->sk_wq); + if (wq_has_sleeper(wq)) + wake_up_interruptible_sync_poll(&wq->wait, POLLOUT | + POLLRDNORM | + POLLRDBAND); + sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT); + rcu_read_unlock(); +} + +static int aead_sendmsg(struct kiocb *unused, struct socket *sock, + struct msghdr *msg, size_t size) +{ + struct sock *sk = sock->sk; + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + unsigned ivsize = + crypto_aead_ivsize(crypto_aead_reqtfm(&ctx->aead_req)); + struct aead_sg_list *sgl = &ctx->tsgl; + struct af_alg_control con = {}; + long copied = 0; + bool enc = 0; + bool init = 0; + int err = -EINVAL; + + if (msg->msg_controllen) { + err = af_alg_cmsg_send(msg, &con); + if (err) + return err; + + init = 1; + switch (con.op) { + case ALG_OP_ENCRYPT: + enc = 1; + break; + case ALG_OP_DECRYPT: + enc = 0; + break; + default: + return -EINVAL; + } + + if (con.iv && con.iv->ivlen != ivsize) + return -EINVAL; + + if (!con.aead_assoclen) + return -EINVAL; + + /* aead_recvmsg limits the maximum AD size to one page */ + if (con.aead_assoclen > PAGE_SIZE) + return -E2BIG; + } + + lock_sock(sk); + if (!ctx->more && ctx->used) + goto unlock; + + if (init) { + ctx->enc = enc; + if (con.iv) + memcpy(ctx->iv, con.iv->iv, ivsize); + + ctx->aead_assoclen = con.aead_assoclen; + } + + while (size) { + unsigned long len = size; + struct scatterlist *sg = NULL; + + if (ctx->merge) { + sg = sgl->sg + sgl->cur - 1; + len = min_t(unsigned long, len, + PAGE_SIZE - sg->offset - sg->length); + err = memcpy_from_msg(page_address(sg_page(sg)) + + sg->offset + sg->length, + msg, len); + if (err) + goto unlock; + + sg->length += len; + ctx->merge = (sg->offset + sg->length) & + (PAGE_SIZE - 1); + + ctx->used += len; + copied += len; + size -= len; + } + + if (!aead_writable(sk)) { + /* + * If there is more data to be expected, but we cannot + * write more data, forcefully define that we do not + * expect more data to invoke the AEAD operation. This + * prevents a deadlock in user space. + */ + ctx->more = 0; + err = aead_wait_for_wmem(sk, msg->msg_flags); + if (err) + goto unlock; + } + + len = min_t(unsigned long, size, aead_sndbuf(sk)); + while (len && sgl->cur < ALG_MAX_PAGES) { + int plen = 0; + + sg = sgl->sg + sgl->cur; + plen = min_t(int, len, PAGE_SIZE); + + if (sgl->cur >= ALG_MAX_PAGES) { + err = -E2BIG; + goto unlock; + } + + sg_assign_page(sg, alloc_page(GFP_KERNEL)); + err = -ENOMEM; + if (!sg_page(sg)) + goto unlock; + + err = memcpy_from_msg(page_address(sg_page(sg)), + msg, plen); + if (err) { + __free_page(sg_page(sg)); + sg_assign_page(sg, NULL); + goto unlock; + } + + sg->length = plen; + len -= plen; + ctx->used += plen; + copied += plen; + sgl->cur++; + size -= plen; + ctx->merge = plen & (PAGE_SIZE - 1); + } + } + + err = 0; + + ctx->more = msg->msg_flags & MSG_MORE; + +unlock: + aead_data_wakeup(sk); + release_sock(sk); + + return copied ?: err; +} + +static ssize_t aead_sendpage(struct socket *sock, struct page *page, + int offset, size_t size, int flags) +{ + struct sock *sk = sock->sk; + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + struct aead_sg_list *sgl = &ctx->tsgl; + int err = -EINVAL; + + if (flags & MSG_SENDPAGE_NOTLAST) + flags |= MSG_MORE; + + if (sgl->cur >= ALG_MAX_PAGES) + return -E2BIG; + + lock_sock(sk); + if (!ctx->more && ctx->used) + goto unlock; + + if (!size) + goto done; + + if (!aead_writable(sk)) { + /* see aead_sendmsg why more is set to 0 */ + ctx->more = 0; + err = aead_wait_for_wmem(sk, flags); + if (err) + goto unlock; + } + + ctx->merge = 0; + + get_page(page); + sg_set_page(sgl->sg + sgl->cur, page, size, offset); + sgl->cur++; + ctx->used += size; + + err = 0; + +done: + ctx->more = flags & MSG_MORE; + +unlock: + aead_data_wakeup(sk); + release_sock(sk); + + return err ?: size; +} + +static int aead_recvmsg(struct kiocb *unused, struct socket *sock, + struct msghdr *msg, size_t ignored, int flags) +{ + struct sock *sk = sock->sk; + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + unsigned bs = crypto_aead_blocksize(crypto_aead_reqtfm(&ctx->aead_req)); + unsigned as = crypto_aead_authsize(crypto_aead_reqtfm(&ctx->aead_req)); + struct aead_sg_list *sgl = &ctx->tsgl; + struct scatterlist *sg = sgl->sg; + struct scatterlist assoc; + size_t assoclen = 0; + unsigned int i = 0; + int err = -EAGAIN; + unsigned long used = 0; + unsigned long outlen = 0; + + /* + * Require exactly one IOV block as the AEAD operation is a one shot + * due to the authentication tag. + */ + if (msg->msg_iter.nr_segs != 1) + return -ENOMSG; + + lock_sock(sk); + /* + * AEAD memory structure: For encryption, the tag is appended to the + * ciphertext which implies that the memory allocated for the ciphertext + * must be increased by the tag length. For decryption, the tag + * is expected to be concatenated to the ciphertext. The plaintext + * therefore has a memory size of the ciphertext minus the tag length. + * + * The memory structure for cipher operation has the following + * structure: + * AEAD encryption input: assoc data || plaintext + * AEAD encryption output: cipherntext || auth tag + * AEAD decryption input: assoc data || ciphertext || auth tag + * AEAD decryption output: plaintext + */ + + if (ctx->more) { + err = aead_wait_for_data(sk, flags); + if (err) + goto unlock; + } + + used = ctx->used; + + err = -EINVAL; + /* + * The cipher operation input data is reduced by the associated data + * length as this data is processed separately later on. + */ + used -= ctx->aead_assoclen; + + if (ctx->enc) { + /* round up output buffer to multiple of block size */ + outlen = ((used + bs - 1) / bs * bs); + /* add the size needed for the auth tag to be created */ + outlen += as; + } else { + /* output data size is input without the authentication tag */ + outlen = used - as; + /* round up output buffer to multiple of block size */ + outlen = ((outlen + bs - 1) / bs * bs); + } + + /* ensure output buffer is sufficiently large */ + if (msg->msg_iter.iov->iov_len < outlen) + goto unlock; + + outlen = af_alg_make_sg(&ctx->rsgl, msg->msg_iter.iov->iov_base, + outlen, 1); + err = outlen; + if (err < 0) + goto unlock; + + err = -EINVAL; + /* + * first chunk of input is AD -- one scatterlist entry is one page, + * and we process only one scatterlist, the maximum size of AD is + * one page + */ + sg_init_table(&assoc, 1); + sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); + aead_request_set_assoc(&ctx->aead_req, &assoc, ctx->aead_assoclen); + + /* point sg to cipher/plaintext start */ + assoclen = ctx->aead_assoclen; + for(i = 0; i < ctx->tsgl.cur; i++) { + sg = sgl->sg + i; + if (sg->length <= assoclen) { + assoclen -= sg->length; + if (i >= ctx->tsgl.cur) + goto unlock; + } else { + sg->length -= assoclen; + sg->offset += assoclen; + break; + } + } + + aead_request_set_crypt(&ctx->aead_req, sg, ctx->rsgl.sg, used, ctx->iv); + + err = af_alg_wait_for_completion(ctx->enc ? + crypto_aead_encrypt(&ctx->aead_req) : + crypto_aead_decrypt(&ctx->aead_req), + &ctx->completion); + + af_alg_free_sg(&ctx->rsgl); + + if (err) + goto unlock; + + aead_put_sgl(sk); + + err = 0; + +unlock: + aead_wmem_wakeup(sk); + release_sock(sk); + + return err ? err : outlen; +} + +static unsigned int aead_poll(struct file *file, struct socket *sock, + poll_table *wait) +{ + struct sock *sk = sock->sk; + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + unsigned int mask; + + sock_poll_wait(file, sk_sleep(sk), wait); + mask = 0; + + if (!ctx->more) + mask |= POLLIN | POLLRDNORM; + + if (aead_writable(sk)) + mask |= POLLOUT | POLLWRNORM | POLLWRBAND; + + return mask; +} + +static struct proto_ops algif_aead_ops = { + .family = PF_ALG, + + .connect = sock_no_connect, + .socketpair = sock_no_socketpair, + .getname = sock_no_getname, + .ioctl = sock_no_ioctl, + .listen = sock_no_listen, + .shutdown = sock_no_shutdown, + .getsockopt = sock_no_getsockopt, + .mmap = sock_no_mmap, + .bind = sock_no_bind, + .accept = sock_no_accept, + .setsockopt = sock_no_setsockopt, + + .release = af_alg_release, + .sendmsg = aead_sendmsg, + .sendpage = aead_sendpage, + .recvmsg = aead_recvmsg, + .poll = aead_poll, +}; + +static void *aead_bind(const char *name, u32 type, u32 mask) +{ + return crypto_alloc_aead(name, type, mask); +} + +static void aead_release(void *private) +{ + crypto_free_aead(private); +} + +static int aead_setauthsize(void *private, unsigned int authsize) +{ + return crypto_aead_setauthsize(private, authsize); +} + +static int aead_setkey(void *private, const u8 *key, unsigned int keylen) +{ + return crypto_aead_setkey(private, key, keylen); +} + +static void aead_sock_destruct(struct sock *sk) +{ + struct alg_sock *ask = alg_sk(sk); + struct aead_ctx *ctx = ask->private; + unsigned int ivlen = crypto_aead_ivsize( + crypto_aead_reqtfm(&ctx->aead_req)); + + aead_put_sgl(sk); + sock_kzfree_s(sk, ctx->iv, ivlen); + sock_kfree_s(sk, ctx, ctx->len); + af_alg_release_parent(sk); +} + +static int aead_accept_parent(void *private, struct sock *sk) +{ + struct aead_ctx *ctx; + struct alg_sock *ask = alg_sk(sk); + unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(private); + unsigned int ivlen = crypto_aead_ivsize(private); + + ctx = sock_kmalloc(sk, len, GFP_KERNEL); + if (!ctx) + return -ENOMEM; + memset(ctx, 0, len); + + ctx->iv = sock_kmalloc(sk, ivlen, GFP_KERNEL); + if (!ctx->iv) { + sock_kfree_s(sk, ctx, len); + return -ENOMEM; + } + memset(ctx->iv, 0, ivlen); + + ctx->len = len; + ctx->used = 0; + ctx->more = 0; + ctx->merge = 0; + ctx->enc = 0; + ctx->tsgl.cur = 0; + ctx->aead_assoclen = 0; + af_alg_init_completion(&ctx->completion); + sg_init_table(ctx->tsgl.sg, ALG_MAX_PAGES); + + ask->private = ctx; + + aead_request_set_tfm(&ctx->aead_req, private); + aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG, + af_alg_complete, &ctx->completion); + + sk->sk_destruct = aead_sock_destruct; + + return 0; +} + +static const struct af_alg_type algif_type_aead = { + .bind = aead_bind, + .release = aead_release, + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .accept = aead_accept_parent, + .ops = &algif_aead_ops, + .name = "aead", + .owner = THIS_MODULE +}; + +static int __init algif_aead_init(void) +{ + return af_alg_register_type(&algif_type_aead); +} + +static void __exit algif_aead_exit(void) +{ + int err = af_alg_unregister_type(&algif_type_aead); + BUG_ON(err); +} + +module_init(algif_aead_init); +module_exit(algif_aead_exit); +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>"); +MODULE_DESCRIPTION("AEAD kernel crypto API user space interface"); -- 2.1.0 ^ permalink raw reply related [flat|nested] 13+ messages in thread
[parent not found: <1609020.xcc11L81HZ-PJstQz4BMNNP20K/wil9xYQuADTiUCJX@public.gmane.org>]
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support 2015-01-02 14:41 ` [PATCH v7 1/2] crypto: AF_ALG: add AEAD support Stephan Mueller @ 2015-01-05 10:31 ` Herbert Xu 0 siblings, 0 replies; 13+ messages in thread From: Herbert Xu @ 2015-01-05 10:31 UTC (permalink / raw) To: Stephan Mueller Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-crypto-u79uwXL29TY76Z2rM5mHXA, ABI/API On Fri, Jan 02, 2015 at 03:41:33PM +0100, Stephan Mueller wrote: > > + if (!con.aead_assoclen) > + return -EINVAL; AD being zero should be fine. > + /* aead_recvmsg limits the maximum AD size to one page */ > + if (con.aead_assoclen > PAGE_SIZE) > + return -E2BIG; I don't see any need to limit the size of the AD. Cheers, -- Email: Herbert Xu <herbert-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q@public.gmane.org> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support @ 2015-01-05 10:31 ` Herbert Xu 0 siblings, 0 replies; 13+ messages in thread From: Herbert Xu @ 2015-01-05 10:31 UTC (permalink / raw) To: Stephan Mueller Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API On Fri, Jan 02, 2015 at 03:41:33PM +0100, Stephan Mueller wrote: > > + if (!con.aead_assoclen) > + return -EINVAL; AD being zero should be fine. > + /* aead_recvmsg limits the maximum AD size to one page */ > + if (con.aead_assoclen > PAGE_SIZE) > + return -E2BIG; I don't see any need to limit the size of the AD. Cheers, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ^ permalink raw reply [flat|nested] 13+ messages in thread
[parent not found: <20150105103159.GA24878-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q@public.gmane.org>]
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support 2015-01-05 10:31 ` Herbert Xu @ 2015-01-05 10:46 ` Stephan Mueller -1 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-05 10:46 UTC (permalink / raw) To: Herbert Xu Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-crypto-u79uwXL29TY76Z2rM5mHXA, ABI/API Am Montag, 5. Januar 2015, 21:31:59 schrieb Herbert Xu: Hi Herbert, > On Fri, Jan 02, 2015 at 03:41:33PM +0100, Stephan Mueller wrote: > > + if (!con.aead_assoclen) > > + return -EINVAL; > > AD being zero should be fine. Ok, removed. > > > + /* aead_recvmsg limits the maximum AD size to one page */ > > + if (con.aead_assoclen > PAGE_SIZE) > > + return -E2BIG; > > I don't see any need to limit the size of the AD. The need for that check lies in aead_recvmsg: /* * first chunk of input is AD -- one scatterlist entry is one page, * and we process only one scatterlist, the maximum size of AD is * one page */ sg_init_table(&assoc, 1); sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); aead_request_set_assoc(&ctx->aead_req, &assoc, ctx->aead_assoclen); There you see that I only create an sg table with one entry for the AD. If we would allow an arbitrary AD size, I would see the need of a for loop in addition to the one directly beneath this AD scatterlist setting: one for identifying how many sg entries I need to allocate and one for the actual assignment. As I felt that one page should be sufficient for the AD, I wanted to avoid the extra overhead for another for loop. > > Cheers, -- Ciao Stephan ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support @ 2015-01-05 10:46 ` Stephan Mueller 0 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-05 10:46 UTC (permalink / raw) To: Herbert Xu Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API Am Montag, 5. Januar 2015, 21:31:59 schrieb Herbert Xu: Hi Herbert, > On Fri, Jan 02, 2015 at 03:41:33PM +0100, Stephan Mueller wrote: > > + if (!con.aead_assoclen) > > + return -EINVAL; > > AD being zero should be fine. Ok, removed. > > > + /* aead_recvmsg limits the maximum AD size to one page */ > > + if (con.aead_assoclen > PAGE_SIZE) > > + return -E2BIG; > > I don't see any need to limit the size of the AD. The need for that check lies in aead_recvmsg: /* * first chunk of input is AD -- one scatterlist entry is one page, * and we process only one scatterlist, the maximum size of AD is * one page */ sg_init_table(&assoc, 1); sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); aead_request_set_assoc(&ctx->aead_req, &assoc, ctx->aead_assoclen); There you see that I only create an sg table with one entry for the AD. If we would allow an arbitrary AD size, I would see the need of a for loop in addition to the one directly beneath this AD scatterlist setting: one for identifying how many sg entries I need to allocate and one for the actual assignment. As I felt that one page should be sufficient for the AD, I wanted to avoid the extra overhead for another for loop. > > Cheers, -- Ciao Stephan ^ permalink raw reply [flat|nested] 13+ messages in thread
[parent not found: <6798882.ly1QjqTYep-PJstQz4BMNNP20K/wil9xYQuADTiUCJX@public.gmane.org>]
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support 2015-01-05 10:46 ` Stephan Mueller @ 2015-01-05 10:51 ` Herbert Xu -1 siblings, 0 replies; 13+ messages in thread From: Herbert Xu @ 2015-01-05 10:51 UTC (permalink / raw) To: Stephan Mueller Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-crypto-u79uwXL29TY76Z2rM5mHXA, ABI/API On Mon, Jan 05, 2015 at 11:46:50AM +0100, Stephan Mueller wrote: > > The need for that check lies in aead_recvmsg: > > /* > * first chunk of input is AD -- one scatterlist entry is one page, > * and we process only one scatterlist, the maximum size of AD is > * one page > */ > sg_init_table(&assoc, 1); > sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); > aead_request_set_assoc(&ctx->aead_req, &assoc, ctx->aead_assoclen); > > There you see that I only create an sg table with one entry for the AD. If we > would allow an arbitrary AD size, I would see the need of a for loop in > addition to the one directly beneath this AD scatterlist setting: one for > identifying how many sg entries I need to allocate and one for the actual > assignment. > > As I felt that one page should be sufficient for the AD, I wanted to avoid the > extra overhead for another for loop. Please remove the limit as otherwise we would never be able to add support for this in a future kernel as appliations won't be able to rely on it. There is no such limit in the kernel interface and we shouldn't be adding one here. Cheers, -- Email: Herbert Xu <herbert-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q@public.gmane.org> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support @ 2015-01-05 10:51 ` Herbert Xu 0 siblings, 0 replies; 13+ messages in thread From: Herbert Xu @ 2015-01-05 10:51 UTC (permalink / raw) To: Stephan Mueller Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API On Mon, Jan 05, 2015 at 11:46:50AM +0100, Stephan Mueller wrote: > > The need for that check lies in aead_recvmsg: > > /* > * first chunk of input is AD -- one scatterlist entry is one page, > * and we process only one scatterlist, the maximum size of AD is > * one page > */ > sg_init_table(&assoc, 1); > sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); > aead_request_set_assoc(&ctx->aead_req, &assoc, ctx->aead_assoclen); > > There you see that I only create an sg table with one entry for the AD. If we > would allow an arbitrary AD size, I would see the need of a for loop in > addition to the one directly beneath this AD scatterlist setting: one for > identifying how many sg entries I need to allocate and one for the actual > assignment. > > As I felt that one page should be sufficient for the AD, I wanted to avoid the > extra overhead for another for loop. Please remove the limit as otherwise we would never be able to add support for this in a future kernel as appliations won't be able to rely on it. There is no such limit in the kernel interface and we shouldn't be adding one here. Cheers, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support 2015-01-05 10:51 ` Herbert Xu (?) @ 2015-01-05 10:54 ` Stephan Mueller -1 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-05 10:54 UTC (permalink / raw) To: Herbert Xu Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API Am Montag, 5. Januar 2015, 21:51:06 schrieb Herbert Xu: Hi Herbert, > On Mon, Jan 05, 2015 at 11:46:50AM +0100, Stephan Mueller wrote: > > The need for that check lies in aead_recvmsg: > > /* > > > > * first chunk of input is AD -- one scatterlist entry is one > > page, > > * and we process only one scatterlist, the maximum size of AD is > > * one page > > */ > > > > sg_init_table(&assoc, 1); > > sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); > > aead_request_set_assoc(&ctx->aead_req, &assoc, > > ctx->aead_assoclen); > > > > There you see that I only create an sg table with one entry for the AD. If > > we would allow an arbitrary AD size, I would see the need of a for loop > > in addition to the one directly beneath this AD scatterlist setting: one > > for identifying how many sg entries I need to allocate and one for the > > actual assignment. > > > > As I felt that one page should be sufficient for the AD, I wanted to avoid > > the extra overhead for another for loop. > > Please remove the limit as otherwise we would never be able to > add support for this in a future kernel as appliations won't be > able to rely on it. > > There is no such limit in the kernel interface and we shouldn't > be adding one here. Ok, will do. > > Cheers, -- Ciao Stephan ^ permalink raw reply [flat|nested] 13+ messages in thread
[parent not found: <20150105105105.GA25517-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q@public.gmane.org>]
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support 2015-01-05 10:51 ` Herbert Xu @ 2015-01-05 11:14 ` Stephan Mueller -1 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-05 11:14 UTC (permalink / raw) To: Herbert Xu Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel-u79uwXL29TY76Z2rM5mHXA, linux-crypto-u79uwXL29TY76Z2rM5mHXA, ABI/API Am Montag, 5. Januar 2015, 21:51:06 schrieb Herbert Xu: Hi Herbert, > On Mon, Jan 05, 2015 at 11:46:50AM +0100, Stephan Mueller wrote: > > The need for that check lies in aead_recvmsg: > > /* > > > > * first chunk of input is AD -- one scatterlist entry is one > > page, > > * and we process only one scatterlist, the maximum size of AD is > > * one page > > */ > > > > sg_init_table(&assoc, 1); > > sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); > > aead_request_set_assoc(&ctx->aead_req, &assoc, > > ctx->aead_assoclen); > > > > There you see that I only create an sg table with one entry for the AD. If > > we would allow an arbitrary AD size, I would see the need of a for loop > > in addition to the one directly beneath this AD scatterlist setting: one > > for identifying how many sg entries I need to allocate and one for the > > actual assignment. > > > > As I felt that one page should be sufficient for the AD, I wanted to avoid > > the extra overhead for another for loop. > > Please remove the limit as otherwise we would never be able to > add support for this in a future kernel as appliations won't be > able to rely on it. > > There is no such limit in the kernel interface and we shouldn't > be adding one here. One question: are you aware of an existing mechanism to split one scatterlist into two at a given offset? > > Cheers, -- Ciao Stephan ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v7 1/2] crypto: AF_ALG: add AEAD support @ 2015-01-05 11:14 ` Stephan Mueller 0 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-05 11:14 UTC (permalink / raw) To: Herbert Xu Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API Am Montag, 5. Januar 2015, 21:51:06 schrieb Herbert Xu: Hi Herbert, > On Mon, Jan 05, 2015 at 11:46:50AM +0100, Stephan Mueller wrote: > > The need for that check lies in aead_recvmsg: > > /* > > > > * first chunk of input is AD -- one scatterlist entry is one > > page, > > * and we process only one scatterlist, the maximum size of AD is > > * one page > > */ > > > > sg_init_table(&assoc, 1); > > sg_set_page(&assoc, sg_page(sg), ctx->aead_assoclen, sg->offset); > > aead_request_set_assoc(&ctx->aead_req, &assoc, > > ctx->aead_assoclen); > > > > There you see that I only create an sg table with one entry for the AD. If > > we would allow an arbitrary AD size, I would see the need of a for loop > > in addition to the one directly beneath this AD scatterlist setting: one > > for identifying how many sg entries I need to allocate and one for the > > actual assignment. > > > > As I felt that one page should be sufficient for the AD, I wanted to avoid > > the extra overhead for another for loop. > > Please remove the limit as otherwise we would never be able to > add support for this in a future kernel as appliations won't be > able to rely on it. > > There is no such limit in the kernel interface and we shouldn't > be adding one here. One question: are you aware of an existing mechanism to split one scatterlist into two at a given offset? > > Cheers, -- Ciao Stephan ^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v7 2/2] crypto: AF_ALG: enable AEAD interface compilation 2015-01-02 14:40 ` Stephan Mueller (?) (?) @ 2015-01-02 14:42 ` Stephan Mueller -1 siblings, 0 replies; 13+ messages in thread From: Stephan Mueller @ 2015-01-02 14:42 UTC (permalink / raw) To: 'Herbert Xu' Cc: Daniel Borkmann, 'Quentin Gouchet', linux-kernel, linux-crypto, ABI/API Enable compilation of the AEAD AF_ALG support and provide a Kconfig option to compile the AEAD AF_ALG support. Signed-off-by: Stephan Mueller <smueller@chronox.de> --- crypto/Kconfig | 9 +++++++++ crypto/Makefile | 1 + 2 files changed, 10 insertions(+) diff --git a/crypto/Kconfig b/crypto/Kconfig index 50f4da4..41a3fc5 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -1523,6 +1523,15 @@ config CRYPTO_USER_API_RNG This option enables the user-spaces interface for random number generator algorithms. +config CRYPTO_USER_API_AEAD + tristate "User-space interface for AEAD cipher algorithms" + depends on NET + select CRYPTO_AEAD + select CRYPTO_USER_API + help + This option enables the user-spaces interface for AEAD + cipher algorithms. + config CRYPTO_HASH_INFO bool diff --git a/crypto/Makefile b/crypto/Makefile index ba19465..97b7d3a 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -100,6 +100,7 @@ obj-$(CONFIG_CRYPTO_USER_API) += af_alg.o obj-$(CONFIG_CRYPTO_USER_API_HASH) += algif_hash.o obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o obj-$(CONFIG_CRYPTO_USER_API_RNG) += algif_rng.o +obj-$(CONFIG_CRYPTO_USER_API_AEAD) += algif_aead.o # # generic algorithms and the async_tx api -- 2.1.0 ^ permalink raw reply related [flat|nested] 13+ messages in thread
end of thread, other threads:[~2015-01-05 11:14 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-02 14:40 [PATCH v7 0/2] crypto: AF_ALG: add AEAD and RNG support Stephan Mueller
2015-01-02 14:40 ` Stephan Mueller
2015-01-02 14:41 ` [PATCH v7 1/2] crypto: AF_ALG: add AEAD support Stephan Mueller
[not found] ` <1609020.xcc11L81HZ-PJstQz4BMNNP20K/wil9xYQuADTiUCJX@public.gmane.org>
2015-01-05 10:31 ` Herbert Xu
2015-01-05 10:31 ` Herbert Xu
[not found] ` <20150105103159.GA24878-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q@public.gmane.org>
2015-01-05 10:46 ` Stephan Mueller
2015-01-05 10:46 ` Stephan Mueller
[not found] ` <6798882.ly1QjqTYep-PJstQz4BMNNP20K/wil9xYQuADTiUCJX@public.gmane.org>
2015-01-05 10:51 ` Herbert Xu
2015-01-05 10:51 ` Herbert Xu
2015-01-05 10:54 ` Stephan Mueller
[not found] ` <20150105105105.GA25517-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q@public.gmane.org>
2015-01-05 11:14 ` Stephan Mueller
2015-01-05 11:14 ` Stephan Mueller
2015-01-02 14:42 ` [PATCH v7 2/2] crypto: AF_ALG: enable AEAD interface compilation Stephan Mueller
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.